hdfc-smart-statement 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Ashik Nesin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,30 @@
-# Temporary Holding Version
+# hdfc-smart-statement
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Extract the transactions table from an HDFC Bank **Smart Statement** email link as CSV — no browser, no dependencies.
+
+## CLI
+
+```sh
+HDFC_PASSWORD=xxxx npx hdfc-smart-statement "<smart statement url>" transactions.csv
+```
+
+Omit the output file to print CSV to stdout. The password is read from the `HDFC_PASSWORD` environment variable so it stays out of shell history.
+
+## API
+
+```js
+import { statementToCsv, fetchStatementHtml, parseTransactions } from 'hdfc-smart-statement';
+
+const csv = await statementToCsv(url, password);
+```
+
+`parseTransactions(html)` returns `{ header, rows }` if you'd rather have arrays than CSV.
+
+## How it works
+
+The Smart Statement page encrypts your password in the browser with a script served by HDFC (run here in a `vm`) and returns the statement as an AES-128-ECB blob whose key is embedded in the response. This tool replays that flow and parses the "Account Statement" table. Values are kept exactly as HDFC shows them (e.g. `"2,00,000.00"`, `-` for empty).
+
+## Caveats
+
+- Relies on undocumented HDFC endpoints; it may break without notice.
+- Unofficial and unaffiliated with HDFC Bank. Your credentials only go to the HDFC host in the link you provide.

package/bin/cli.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import { statementToCsv } from '../src/index.js';
+
+const [url, outFile] = process.argv.slice(2);
+const password = process.env.HDFC_PASSWORD;
+if (!url || !password) {
+  console.error('Usage: HDFC_PASSWORD=xxxx hdfc-smart-statement "<smart statement url>" [out.csv]');
+  console.error('Writes CSV to stdout when no output file is given.');
+  process.exit(1);
+}
+
+try {
+  const csv = await statementToCsv(url, password);
+  if (outFile) {
+    fs.writeFileSync(outFile, csv);
+    console.error(`Wrote ${csv.trimEnd().split('\n').length - 1} transactions to ${outFile}`);
+  } else {
+    process.stdout.write(csv);
+  }
+} catch (e) {
+  console.error(`Error: ${e.message}`);
+  process.exit(1);
+}

package/package.json

@@ -1,6 +1,14 @@
 {
   "name": "hdfc-smart-statement",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Extract transactions from an HDFC Bank Smart Statement link as CSV, without a browser",
+  "type": "module",
+  "main": "./src/index.js",
+  "exports": "./src/index.js",
+  "bin": { "hdfc-smart-statement": "./bin/cli.js" },
+  "files": ["src", "bin"],
+  "engines": { "node": ">=18" },
+  "keywords": ["hdfc", "bank", "smart-statement", "csv", "india", "statement"],
+  "license": "MIT",
+  "author": "Ashik Nesin"
+}

package/src/index.js

@@ -0,0 +1,79 @@
+import crypto from 'node:crypto';
+import vm from 'node:vm';
+
+const UA = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120 Safari/537.36';
+
+const decodeEntities = (s) =>
+  s
+    .replace(/<[^>]*>/g, '')
+    .replace(/&nbsp;/g, ' ')
+    .replace(/&amp;/g, '&')
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&#(\d+);/g, (_, n) => String.fromCharCode(n))
+    .replace(/\s+/g, ' ')
+    .trim();
+
+const csvCell = (v) => (/[",\n]/.test(v) ? `"${v.replace(/"/g, '""')}"` : v);
+
+/** Logs in to a Smart Statement link and returns the decrypted statement HTML. */
+export async function fetchStatementHtml(url, password) {
+  const base = new URL('.', url).href;
+  const cookies = new Map();
+
+  async function http(target, init = {}) {
+    const cookie = [...cookies].map(([k, v]) => `${k}=${v}`).join('; ');
+    const res = await fetch(target, {
+      ...init,
+      headers: { 'User-Agent': UA, ...(cookie && { Cookie: cookie }), ...init.headers },
+    });
+    for (const c of res.headers.getSetCookie()) {
+      const [kv] = c.split(';');
+      const i = kv.indexOf('=');
+      cookies.set(kv.slice(0, i), kv.slice(i + 1));
+    }
+    if (!res.ok) throw new Error(`${res.status} ${res.statusText} for ${target}`);
+    return res.text();
+  }
+
+  const loginHtml = await http(url);
+  const field = (id) => loginHtml.match(new RegExp(`id=["']${id}["'][^>]*value=['"]([^'"]*)['"]`))?.[1];
+  const jobkey = field('ke');
+  const seqence = field('seqence');
+  if (!jobkey) throw new Error('Could not find jobkey on login page (link expired?)');
+
+  const token = (await http(`${base}CRSGetToken?jobkey=${jobkey}`)).trim();
+  const ctx = vm.createContext({ Math });
+  vm.runInContext(await http(`${base}js/encrypt.js`), ctx);
+
+  const stmtHtml = await http(`${base}webresources/app/htmlformat`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Referer: url },
+    body: new URLSearchParams({ ke: jobkey, seqence, pwd: ctx.encrypt(token + password) }),
+  });
+  const m = stmtHtml.match(/Data\("([^"]+)","([^"]+)"\)/);
+  if (!m) throw new Error('Statement not returned - wrong password or expired link?');
+
+  const decipher = crypto.createDecipheriv('aes-128-ecb', Buffer.from(m[1], 'base64'), null);
+  return Buffer.concat([decipher.update(Buffer.from(m[2], 'base64')), decipher.final()]).toString('utf8');
+}
+
+/** Parses the Account Statement transactions table into `{ header, rows }` (7 visible columns). */
+export function parseTransactions(html) {
+  const table = html.match(/<table[^>]*id="Table76"[\s\S]*?<\/table>/)?.[0];
+  if (!table) throw new Error('Transactions table not found in decrypted statement');
+  const [header, ...rows] = [...table.matchAll(/<tr[^>]*>([\s\S]*?)<\/tr>/g)].map((r) =>
+    [...r[1].matchAll(/<t[hd][^>]*>([\s\S]*?)<\/t[hd]>/g)].map((c) => decodeEntities(c[1])).slice(0, 7),
+  );
+  return { header: header.map((h, i) => (i >= 4 ? `${h} (INR)` : h)), rows };
+}
+
+export function toCsv({ header, rows }) {
+  return [header, ...rows].map((r) => r.map(csvCell).join(',')).join('\n') + '\n';
+}
+
+/** Convenience: link + password in, CSV string out. */
+export async function statementToCsv(url, password) {
+  return toCsv(parseTransactions(await fetchStatementHtml(url, password)));
+}